The frenzy of activity triggered by a network attack requires a new approach to threat management, one that makes the network and its resources a partner in its own defense and allows Security and Operations to work together to resolve the problem.
The frenzy of activity triggered by a network attack requires a new approach to threat management, one that makes the network and its resources a partner in its own defense and allows security and operations groups to work together to resolve the problem.
Routers, switches and more can be allies in protecting the network by leveraging topology information and change procedures provided by a network configuration management system. In combination with threat-detection products such as an intrusion detection systems or security information management (SIM) systems, configuration management systems also offer the ability to document, audit and reverse changes, which is critical to successful protection against network-borne attacks.
To reduce the amount of time you are exposed to a threat, security and network groups must work together to investigate, diagnose, remediate and document problems. However, neither organization has the information, expertise or authority to respond unilaterally. Security focuses on defining and monitoring the policies that protect the organization and on detecting threats or out-of-policy behavior. The network organization primarily ensures that the infrastructure delivers the service levels required and solves problems as they arise. Effective threat response is the combination of the right tools and the right processes that can meld these organizations into a single team.
To start, the security group must decide what its policies are regarding network protection, availability and service level. The organization needs to answer questions such as, “Which users and business processes get priority?” and “What can be sacrificed for the greater good?” These insights help reduce unintended collateral impact of real-time changes to network settings in response to an attack.
With a clear understanding of policy, incident-response processes can be crafted by anticipating and accommodating threat scenarios, the staff’s skill level and authority, the need to communicate and document actions taken, and the need to integrate with other organizations, such as the help desk.
Once policies and the associated processes are in place, the network organization uses network configuration management to assemble the information required to make decisions and take action. The group profiles the existing network topology and establishes the value and role of critical servers and users to ensure that policy guidelines and priorities are followed. For example, if you cannot see that the IP address under attack is the payroll server, or cannot see where the payroll server is connected, any network change in response to an attack is guesswork and likely to cause unintended negative consequences.
Remediating the threat
For real-time protection, the reaction to threats is the heart of the process. When a SIM or intrusion prevention system, for example, detects a threat, the incident-response team (pulled from the security, operations and risk management organizations) typically reviews the configuration knowledge base to determine how the affected nodes connect to the network and what role they play.
The security management system or configuration management database provides the role and business value of each node, and a topology database (generated by a network configuration management system and indexed by IP address, media access control address [MAC] or host name) supplies the location. This information helps determine the most precise control point in the connection path.
With access control points determined, the team can leverage response options made available by their network configuration management tools that configure and manage devices such as routers, switches, firewalls and wireless access points. The same actions that network engineers take to maintain the daily operational health of the network now become effective countermeasures in their incident-response toolbox of actions. These include:
* Quarantining a remote user by killing the VPN session or disabling the VPN account.
* Blocking a wireless user from accessing new wireless access points by implementing a MAC filter.
* Blocking total network access when there is only one connection by implementing a port block on the switch.
* Blocking a specific service such as FTP by pushing out a wholesale traffic-control directive to the network.
* If there is a single infected laptop, reassigning the virtual LAN and remediate the affected system.
Beside providing a “surgical strike” response to an attack, network configuration management systems enable easy evaluation of collateral impact. For example, if the primary option is to block a switch port, it is important to know if that port is shared with an IP phone or local hub so that the impact of the change can be fully understood.
Once a control action is selected and authorizations are secured, the management system pushes out and documents the required changes. The system’s automated documentation offers several benefits. The documentation provides an audit trail for subsequent management and audit/compliance reviews. The documentation also facilitates the rollback of the change after the system has been remediated or if the change has introduced an undesired impact on network operation.
Automated, network configuration management tools enable predictable and comprehensive incident response processes with technology that uses the existing network infrastructure to remediate threats. With a single system to drive, implement and document the threat-response process, security and network organizations collaborate more effectively to protect the organization and to support compliance and reporting.
Lunetta is vice president of strategy and corporate development at ArcSight and can be reached at llunetta@arcsight.com.
